CVE-2026-105113: Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-03 · updated 2026-10-05
Weakness: CWE-667

Description

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

Affected products

nezhahq nezha: from 1.8.0 before 2.3.13 — fixed in 2.3.13

How to fix

Upgrade to a fixed version: nezhahq nezha 2.3.13. Check the vendor advisory for mitigations.

References

https://github.com/nezhahq/nezha/security/advisories/GHSA-7j7v-j77m-6g3m
https://www.vulncheck.com/advisories/nezha-1.8.0-before-2.3.13-denial-of-service-via-notification-mutex-deadlock
https://github.com/nezhahq/nezha/security/advisories/GHSA-7j7v-j77m-6g3m

Get alerted when CVE-2026-105113 or the next vulnerability affects your stack